FinCEN Crypto Exchange Registration: Requirements, Steps & Compliance
Crypto Exchange Compliance Cost Calculator
Estimate your total compliance costs for FinCEN registration and ongoing AML/CFT requirements based on your business needs
If you’re launching or operating a cryptocurrency exchange in the United States, the first hurdle is getting on the right side of FinCEN. FinCEN registration isn’t a one‑time checkbox; it kicks off a whole compliance engine that covers AML, CFT, state licensing, and more. Below you’ll find exactly who must register, how to do it, and what staying compliant looks like day‑to‑day.
What FinCEN Is and Why It Matters
FinCEN is the Financial Crimes Enforcement Network, a bureau of the U.S. Department of the Treasury. Its mandate under the Bank Secrecy Act (BSA) is to prevent money‑laundering, terrorist financing, and other financial crimes. Since 2013 FinCEN has issued guidance that treats cryptocurrency as a convertible virtual currency (CVC), subjecting it to the same AML rules that apply to cash.
Who Must Register as a Money Services Business (MSB)
FinCEN classifies any entity that transmits money, holds customer funds, or facilitates the exchange of fiat for crypto (or crypto‑for‑crypto) as a Money Services Business (MSB). The following types of crypto‑focused businesses fall squarely into that definition:
- Centralized crypto exchanges that allow users to trade Bitcoin, Ether, or other CVCs against USD or other fiat currencies.
- Custodial wallet providers that hold private keys on behalf of users.
- Crypto payment processors that move value from one party to another.
- Any platform that offers crypto‑fiat conversion services, including peer‑to‑peer match‑making services that actually execute the transfer.
If you only provide a non‑custodial, decentralized order‑book that never touches user funds, FinCEN may consider you out of scope. But the safest rule of thumb: once you hold or move customer money, you need to register.
Step‑By‑Step: Registering Your Exchange with FinCEN
- Create a BSA Identifier: Start by filing FinCEN Form 107 - the Registration of Money Services Business. You’ll need your legal entity name, EIN, and primary contact details.
- Develop an AML Program: The BSA requires a written anti‑money‑laundering program covering risk assessment, internal controls, independent testing, and a designated compliance officer.
- Implement a Customer Identification Program (CIP): Verify user identities using government‑issued ID, address verification, and, for high‑risk customers, additional sources such as credit bureaus.
- Set Up Record‑Keeping Systems: Store transaction logs, account opening documents, and AML risk assessments for at least five years. Use searchable databases to retrieve records quickly.
- File the Registration: Submit the completed Form 107 via FinCEN’s BSA E‑Filing System. There is a modest federal fee (currently $150 for a new registration).
- Receive Confirmation: FinCEN will issue a registration number. You must display this number on your website’s compliance page and on any AML‑related communications.
Registration is only the beginning; you must maintain the program, update it as your business evolves, and file periodic SARs (Suspicious Activity Reports) when needed.
Ongoing AML & CFT Obligations
After registering, FinCEN expects you to run a live AML operation:
- Transaction Monitoring: Deploy software that flags patterns like rapid turnover, structuring, or transfers to high‑risk jurisdictions.
- Suspicious Activity Reporting: File a SAR within 30 days of detecting suspicious behavior involving $5,000 or more.
- Currency Transaction Reporting: Submit a CTR for any single transaction of $10,000 or more, even if it looks legitimate.
- Periodic Independent Audits: Conduct at least an annual review of your AML controls by an external auditor.
Failing to meet these requirements can lead to civil penalties of up to $1 million per violation and criminal prosecution for willful violations.
State Money‑Transmitter Licenses (MTLs) and BitLicense
FinCEN registration is federal; you still need state‑level authorization to actually do business in each jurisdiction. Most states require a Money Transmission License (MTL). The process varies dramatically-some states approve in weeks, others take months and demand hefty fees.
New York adds an extra layer: the BitLicense, which imposes its own capital, bonding, and reporting rules. If you plan to serve New York customers, budgeting for a separate application (often $50 k‑$150 k) is essential.
Recent Regulatory Moves (2023‑2024)
FinCEN’s 2023 proposal on “Transactions Involving Convertible Virtual Currency or Digital Assets” treats CVCs as “monetary instruments.” The rule would:
- Require MSBs to collect and verify identity information for unhosted wallet owners.
- Oblige banks and MSBs to file “Travel Rule” reports for crypto‑to‑crypto transfers over $10,000.
- Expand record‑keeping to include wallet addresses, public keys, and transaction hashes.
While the final rule is still pending as of October 2025, many exchanges have already upgraded their systems to meet the anticipated requirements.
Cost Considerations: Beyond the 0 Registration Fee
Real‑world compliance budgets often dwarf the nominal federal fee. Typical line items include:
| Expense | Estimated Range (USD) |
|---|---|
| State MTL applications (all 50 states) | $200,000-$500,000 |
| BitLicense (NY only) | $75,000-$150,000 |
| AML software platform | $50,000-$120,000 (annual) |
| KYC verification services | $0.10-$0.30 per verification |
| Legal & consulting fees | $100,000-$250,000 (initial) |
Many startups choose to partner with an already‑licensed MTL holder to shortcut the state‑licensing maze. This “white‑label” approach can reduce upfront cost by 60 % but adds revenue‑sharing obligations.
Common Pitfalls & Pro Tips
- Assuming Registration Equals Immunity: FinCEN can still audit your AML program at any time. Keep documentation tidy and up‑to‑date.
- Neglecting the Travel Rule: Failure to transmit required originator/beneficiary data on cross‑border transfers can trigger hefty fines.
- Overlooking Unhosted Wallets: The 2023 proposal treats wallets you don’t control as “customers.” Capture address data at the point of first transaction.
- Skipping State Licenses: Federal registration won’t shield you from state enforcement actions if you accept fiat from residents of a state where you lack an MTL.
- Under‑Investing in Technology: Manual monitoring won’t scale. Choose a platform that integrates directly with your order‑book and can flag patterns in real time.
Implement a compliance calendar, assign a senior compliance officer, and conduct quarterly training for all staff who touch user funds.
Key Takeaways
- Any crypto exchange that holds, moves, or converts customer funds must register as an MSB with FinCEN.
- Registration triggers a continuous AML program: KYC, record‑keeping, transaction monitoring, SAR/CTR filing.
- State Money Transmitter Licenses are required in each state; New York adds the BitLicense.
- Upcoming FinCEN rules will tighten the Travel Rule and bring unhosted wallets under AML scrutiny.
- Compliance costs can exceed $500k when you factor in technology, legal counsel, and state licensing.
Do I need a FinCEN registration if I only run a decentralized exchange (DEX) that never holds user funds?
Generally no. FinCEN focuses on entities that act as money transmitters-i.e., those that hold, move, or convert crypto on behalf of customers. A pure DEX that only matches orders and leaves custody to users typically falls outside the MSB definition. However, if you add any custodial layer or facilitate fiat‑on‑ramps, registration becomes mandatory.
What is the difference between an MSB registration and a Money Transmission License?
MSB registration is a federal requirement under the BSA; it obliges you to maintain an AML program and report suspicious activity. A Money Transmission License is a state‑level authorization that lets you legally accept and transmit money within that state. Both are needed if you operate nationwide.
How often must I update my AML program?
FinCEN expects a risk‑based approach. At minimum, review and update the program annually, or sooner whenever you launch a new product, enter a new jurisdiction, or after a regulatory change.
What are the penalties for missing a SAR filing?
Civil penalties can reach $1 million per violation, plus possible criminal charges if the omission is willful. Repeated failures markedly increase enforcement scrutiny.
Can I use a third‑party compliance provider instead of building my own AML system?
Yes, many exchanges outsource KYC/AML to specialized vendors. The vendor’s output must still meet FinCEN’s standards, and you remain ultimately responsible for any compliance gaps.
Jessica Pence
Hey folks, just wanted to point out that the BSA Identifier is the first thing you need – make sure you have your EIN handy, otherwise the Form 107 will reject you. Also, don’t forget that your AML program has to be a written document, not just a spreadsheet – FinCEN looks for risk assessments, internal controls, and an independent tester. A common mistake is forgetting to keep records for five years; the rule is strict on that, so set up a searchable database now. Finally, double‑check the registration fee – it’s only $150, but you’ll definately need to budget for state licences later. Good luck, and feel free to ask if you need any clarifications!